Send patches - preferably formatted by git format-patch - to patches at archlinux32 dot org.
summaryrefslogtreecommitdiff
path: root/hooks/archiso
diff options
context:
space:
mode:
authorThomas Bächler <thomas@archlinux.org>2016-02-13 01:08:49 +0100
committerGerardo Exequiel Pozzi <vmlinuz386@gmail.com>2016-02-28 17:09:08 -0300
commitdc20e4e98174d2940af145efa732f2dc4115f337 (patch)
treeb11b9302bcf34bddafbdc9a4426a734dfe7152d5 /hooks/archiso
parent4dd9aaa3a18426a2c7f81364212f84e9022f0f11 (diff)
Add the verify=y option to verify the squashfs signature with gpg
Diffstat (limited to 'hooks/archiso')
-rw-r--r--hooks/archiso24
1 files changed, 24 insertions, 0 deletions
diff --git a/hooks/archiso b/hooks/archiso
index fb76327..b78f4db 100644
--- a/hooks/archiso
+++ b/hooks/archiso
@@ -105,6 +105,15 @@ _verify_checksum() {
return ${_status}
}
+_verify_signature() {
+ local _status
+ cd "/run/archiso/bootmnt/${archisobasedir}/${arch}"
+ gpg --homedir /gpg --status-fd 1 --verify airootfs.sfs.sig 2>/dev/null | grep -qE '^\[GNUPG:\] GOODSIG'
+ _status=$?
+ cd "${OLDPWD}"
+ return ${_status}
+}
+
run_hook() {
[[ -z "${arch}" ]] && arch="$(uname -m)"
[[ -z "${copytoram_size}" ]] && copytoram_size="75%"
@@ -159,6 +168,21 @@ archiso_mount_handler() {
fi
fi
+ if [[ "${verify}" == "y" ]]; then
+ if [[ -f "/run/archiso/bootmnt/${archisobasedir}/${arch}/airootfs.sfs.sig" ]]; then
+ msg -n ":: Signature verification requested, please wait..."
+ if _verify_signature; then
+ msg "done. Signature is OK, continue booting."
+ else
+ echo "ERROR: one or more files are corrupted"
+ launch_interactive_shell
+ fi
+ else
+ echo "ERROR: verify=y option specified but ${archisobasedir}/${arch}/airootfs.sfs.sig not found"
+ launch_interactive_shell
+ fi
+ fi
+
if [[ "${copytoram}" == "y" ]]; then
msg ":: Mounting /run/archiso/copytoram (tmpfs) filesystem, size=${copytoram_size}"
mkdir -p /run/archiso/copytoram